◆ Method note Third-party due diligence Open sources only

Verifying a supplier who is telling you the truth about the wrong things

A seven-stage open-source verification sequence for the case where a supplier's paperwork is complete, its certifications are valid, and something about the relationship has stopped adding up.

Kelroy James Derived from ACQ501 Open-Source Intelligence, University of Abertay Method generalised; no client or supplier identified

📖 12 min read 🔍 7-stage framework

Most third-party risk processes are built to catch a supplier who fails to produce evidence. They are much weaker against a supplier who produces all of it.

A completed questionnaire and a valid certificate each establish something real, within a defined scope. Neither establishes that the operation described in them exists in the place it claims to, is run by the people named on it, or is financially able to deliver what is being bought.

This sequence exists for the gap between those two positions. It runs in a deliberate order, because each stage narrows what the next one has to look for: corporate identity establishes who is being dealt with, geography tests whether the operation is where it says it is, and the financial and documentary stages test whether it can do what it has promised. Running them out of order produces a pile of findings rather than a line of reasoning.

Every stage below draws on publicly available sources. Roughly nine in ten useful facts in a corporate intelligence picture are already public; the discipline is in ordering them, not in obtaining them.

The sequence

Seven stages: order matters

Corporate structure

Establish baseline legitimacy before looking for discrepancies.

Confirm registration status and incorporation date against the statutory register
Identify every director and person of significant control
Read the filing history for lateness, resignations and recent restructuring
Cross-reference the registered office against the trading address given to you
Check that recorded activity codes match what the supplier says it does

Sources

Companies HouseOpenCorporatesCompany Check

Output

Registration verification with full filing and officer history. The authoritative baseline everything later is measured against.

Address and physical presence

Test whether the operation exists where it claims to exist.

Compare the registered office, the trading address and the address on correspondence
Assess physical existence through historical street imagery rather than current imagery alone
Check how many other businesses are registered at the same address
Verify business rates registration with the local authority
Examine property ownership records for the site

Sources

Land Registry192.comStreet imagery (historical)Rates register

Output

Location assessment recording what is verifiable, what is not, and the difference between the two.

Directors and officers

Establish that the people representing the company are the people who control it.

Map every director and controller against the contacts you have dealt with
Verify professional history and any claimed credentials or registrations
Map other directorships and company affiliations for concentration and conflict
Assess online presence for consistency with the professional history claimed
Record where claimed personnel and verified personnel do not overlap

Sources

Director searchOpenCorporatesProfessional registersLinkedIn

Output

Relationship map showing who controls the entity and how they connect to other interests.

Digital infrastructure

Where the systems are hosted, as distinct from where the letterhead says.

Registration records and name server distribution for every associated domain
Hosting geography, certificate detail and platform from technical infrastructure lookups
Historical site captures, to detect changes in claims over time
Message header routing and originating addresses across the correspondence you hold
Sender authentication records, and number type and carrier geography for stated contact numbers

Sources

WHOISDNS lookupsShodanWayback MachineHeader analysisNumber lookup

Output

Infrastructure picture mapping where systems, mail and telephony physically resolve, against the geography claimed.

Documentary authenticity

Test the documents themselves, not only the facts they assert.

Validate format and security features against the issuing authority's current template
Check temporal consistency across issue dates, expiry dates and stated history
Read file metadata on any digital copy for creation date and origin
Cross-reference document content against the corporate record already established

Sources

Issuing-authority templatesMetadata inspectionDocument verification services

Output

Authenticity assessment for each document received, with any inconsistency described rather than characterised.

Financial capability

Whether the supplier can sustain the obligation, not only whether it wants to.

Filed accounts, and whether filing has been timely and consistent
Credit history and payment behaviour towards other counterparties
County court judgments and other registered financial events
Indicators of stress: late payment, charges, changes in banking arrangements
Scale of the obligation you are placing against the balance sheet carrying it

Sources

Filed accountsCredit referenceCCJ registry

Output

Financial risk assessment stating capability and fragility separately. A solvent supplier can still be a single point of failure.

Synthesis

Build the hypothesis, then try to break it.

Consolidate findings across all six preceding stages onto one timeline
Identify correlations, and just as deliberately identify where stages agree
Form an explicit hypothesis about how the supplier operates
Test that hypothesis against the evidence that would disconfirm it
Grade each finding by confidence and record what would change the grade

Sources

Relationship mappingTimeline analysisOSINT Framework

Output

A graded assessment with a stated hypothesis, the evidence for it, and the evidence that would overturn it.

Grading a finding

Before it reaches a decision

Corroborated

Two independent sources

Confirmed against sources that do not derive from each other. Safe to carry into a recommendation, with the sources named.

Indicative

Single source, consistent

One reliable source, not contradicted elsewhere. Directs further enquiry. Does not on its own support an adverse conclusion.

Unresolved

Absence, or conflict

Sources disagree, or expected evidence is missing. Recorded as an open question. Absence of evidence is reported as absence, never as a finding.

The constraints this runs under

Set before collection begins

Purpose defined first

The question being answered is written down before any collection starts. Collection without a stated purpose becomes surveillance of a commercial counterparty, and produces findings nobody can act on.

Public sources only

Publicly available information, accessed as any member of the public would. No circumvention of access controls, consistent with the Computer Misuse Act.

Proportionate to the risk

Depth matched to the value and criticality of what is being bought. A commodity supplier does not warrant stage seven; a sole-source critical component supplier warrants all of it.

Personal data minimised

Individuals appear only where their role in the entity makes them relevant, under UK GDPR. The subject is the company. Directors are in scope because they control it, not because they are findable.

Sources and dates recorded

Every finding carries its source and the date it was retrieved. Company records change; an assessment without dates cannot be reviewed, defended or repeated.

It directs, it does not replace

This is the layer that tells formal due diligence where to look. It is not a substitute for contractual assurance, audit rights, financial verification or, where relevant, export control screening.